Apotrope

Apotrope audits how locked-down a Windows machine actually is. It runs around 55 checks across 14 categories — firewall, BitLocker, RDP, SMB, PowerShell, accounts, services, persistence, patching, the usual suspects — and maps every finding to a CIS Benchmark control. It works out which benchmark applies (Windows 11 v5.0.0, Windows 10 v4.0.0) on its own, so you're not picking versions by hand. At the end you get a 0–100 score with a letter grade, plus reports in three shapes: a self-contained HTML file for whoever is doing the remediation, an executive-style Security Posture Assessment for the decision-makers who care about business impact, and JSON for when you're wiring this into automation. Every finding ships with copy-paste PowerShell remediation, so it's not just naming what's broken and walking off. The whole thing is built around one idea: it stays on the box. No network calls, no telemetry, no cloud account, no agent to install. It's read-only, so it won't touch your registry or flip a single setting. Point it at a machine, get the picture, leave nothing behind. It's a single .exe with no dependencies, or pip install apotrope on Python 3.12+ if you'd rather. Run it without admin for a limited pass, or elevated for the full set. Save a baseline and diff against it later to watch remediation actually land. Tune the checks per environment with an apotrope.toml profile. MIT licensed. Source is on GitHub.